@rakay-technology/kraft 0.7.9 → 0.7.13

package/dist/bare-5S7IYNHZ.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+import {
+  BareRuntime,
+  STATIC_RELEASE_BASE
+} from "./chunk-MK6GYBO4.js";
+import "./chunk-C74WJ3U4.js";
+import "./chunk-N7AJ2D4I.js";
+import "./chunk-ZVFS4LUA.js";
+import "./chunk-D2IM25JV.js";
+import "./chunk-AADWLI2S.js";
+import "./chunk-BIOW6K3V.js";
+import "./chunk-QPUEAYB3.js";
+import "./chunk-QCGVPIYN.js";
+import "./chunk-E3J47WO3.js";
+import "./chunk-7VMXN646.js";
+import "./chunk-BQMBJ32I.js";
+import "./chunk-3CJLKL6E.js";
+import "./chunk-YXXWTBXB.js";
+import "./chunk-G4VGNFGV.js";
+import "./chunk-PXKCZB2I.js";
+export {
+  BareRuntime,
+  STATIC_RELEASE_BASE
+};

package/dist/{chunk-VFPLICBX.js → chunk-3AZY56JP.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-I3DPMTSF.js";
 import {
   edgeFailureReason
-} from "./chunk-PCOTSRS4.js";
+} from "./chunk-QLPQ5NFE.js";
 import {
   probeHostedHttp
 } from "./chunk-ZVFS4LUA.js";
@@ -19,6 +19,8 @@ import {
   EDGE_CHALLENGE_DIR,
   EDGE_CHALLENGE_LOCATION,
   EDGE_CHALLENGE_URL_PREFIX,
+  EDGE_LISTEN_443,
+  EDGE_LISTEN_80,
   EDGE_SAME_PATH_MOUNTS,
   LUA_LOGGER_PATH,
   OPENRESTY_DEFAULT_PATHS,
@@ -30,25 +32,26 @@ import {
   isCloudFrontedHost,
   luaSourceAvailable,
   reloadBareOpenResty
-} from "./chunk-XBGSR22I.js";
+} from "./chunk-XAEYWDBX.js";
 import {
   probeListeningPort
-} from "./chunk-2Y62WP2D.js";
+} from "./chunk-QCGVPIYN.js";
 import {
   EXECUTOR_DELEGATE
-} from "./chunk-YY5DEAZI.js";
+} from "./chunk-BQMBJ32I.js";
 import {
   logEntry,
   sq
-} from "./chunk-BN23UUSF.js";
+} from "./chunk-YXXWTBXB.js";
 import {
   PROXY_DIRECTIVES,
   parseProxyValue,
+  renderHstsValue,
   resolveProxyDirectives,
   resolveRedirectStatus,
   safeErrorMessage,
   sanitizeProxySettings
-} from "./chunk-ND23EK7Y.js";
+} from "./chunk-G4VGNFGV.js";
 
 // ../../packages/adapters/src/infra/nginx.ts
 import {
@@ -386,6 +389,7 @@ var PROXY_HEADERS = `proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $kraft_fwd_proto;
+        proxy_set_header X-Request-ID $request_id;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
@@ -396,7 +400,7 @@ var FORWARD_VARS = `    set $kraft_fwd_proto $scheme;
         set $kraft_fwd_proto https;
         set $kraft_redirect_https 0;
     }`;
-var VHOST_GENERATION = 2;
+var VHOST_GENERATION = 3;
 var GENERATION_MARKER = `# kraft-vhost-gen: ${VHOST_GENERATION}`;
 var GENERATED_HEADER = `# Auto-generated by Kraft - do not edit manually
 ${GENERATION_MARKER}`;
@@ -584,6 +588,12 @@ function renderProxyOptions(proxy, nginxVersion) {
 function renderProxyTlsOptions(proxy, nginxVersion) {
   return renderProxyDirectives(proxy, { tlsOnly: true, nginxVersion });
 }
+function renderHstsHeader(route, opts) {
+  if (!opts.realTls || !route.hsts) return "";
+  const value = renderHstsValue(route.hsts);
+  if (!value) return "";
+  return `    add_header Strict-Transport-Security "${value}" always;`;
+}
 function renderGeoEntries(whitelist) {
   const entries = [
     "        default         0;",
@@ -1228,6 +1238,77 @@ eab-hmac-key = ${this.acmeEabHmacKey}
   async registerRoute(route) {
     assertValidDomain(route.domain);
     await this._mkdir(this.sitesDir);
+    await this.applyVhostBatch([await this.renderVhost(route)]);
+  }
+  /**
+   * Register MANY routes with ONE config test + ONE reload (C5).
+   *
+   * `registerRoute` costs a whole-config `openresty -t` + a reload PER route,
+   * so a multi-domain deploy (or a VHOST_GENERATION bump) paid N tests + N
+   * serial reloads per box. This renders every vhost first — a validation throw
+   * aborts before anything is written — then writes all files and reloads once.
+   * A failed reload restores every file (same self-rollback as the single
+   * route) and reloads once more, so the box never keeps a half-applied set.
+   *
+   * Isolation trade-off, stated plainly: one unrenderable-among-many cannot
+   * happen (rendering precedes all writes and throws first), but one
+   * reload-failing set rolls back the whole set. Callers that need
+   * per-route isolation (a sweep over unrelated projects) keep calling
+   * `registerRoute`; callers that register one deployment's domains together
+   * use this and fall back per-route on failure.
+   */
+  async registerRoutes(routes) {
+    if (routes.length === 0) return;
+    if (routes.length === 1) {
+      await this.registerRoute(routes[0]);
+      return;
+    }
+    for (const route of routes) assertValidDomain(route.domain);
+    await this._mkdir(this.sitesDir);
+    const rendered = [];
+    for (const route of routes) rendered.push(await this.renderVhost(route));
+    await this.applyVhostBatch(rendered);
+  }
+  /** A vhost rendered to memory: what to write where, and whether the emitted
+   *  conf references its bootstrap placeholder (which decides the cleanup). */
+  async applyVhostBatch(rendered) {
+    const snapshots = /* @__PURE__ */ new Map();
+    for (const r of rendered) {
+      if (!snapshots.has(r.configPath)) {
+        snapshots.set(r.configPath, await this._captureFile(r.configPath));
+      }
+      await this._writeFile(r.configPath, r.conf);
+    }
+    try {
+      await this.reload();
+    } catch (err) {
+      for (const r of rendered) {
+        await this._restoreFile(r.configPath, snapshots.get(r.configPath));
+      }
+      await this.reload().catch(() => void 0);
+      throw err;
+    }
+    for (const r of rendered) {
+      if (!r.bootstrapServed) {
+        await this._rm(this.bootstrapCertDir(r.route.domain)).catch(
+          () => void 0
+        );
+      }
+      await this._writeFile(
+        this.routeStatePath(r.slug),
+        JSON.stringify(r.route)
+      ).catch(() => void 0);
+    }
+  }
+  /**
+   * Render a route to its vhost file content WITHOUT writing or reloading.
+   *
+   * Pure render (plus the cert-exists/bootstrap-cert reads that decide which
+   * shape to emit). `registerRoute` / `registerRoutes` share it, so the batch
+   * path cannot drift from the single path — one renderer, two writers.
+   */
+  async renderVhost(route) {
+    assertValidDomain(route.domain);
     const slug = await this.resolveSlug(route.domain);
     const configPath = join(this.sitesDir, `${slug}.conf`);
     if ("staticRoot" in route && route.staticRoot) {
@@ -1237,6 +1318,7 @@ eab-hmac-key = ${this.acmeEabHmacKey}
     } else {
       assertValidUpstream(route.targetUrl);
     }
+    if (route.webhookProxy) assertValidUpstream(route.webhookProxy);
     const hostRedirect = renderHostRedirect(route);
     const locationBody = hostRedirect ? hostRedirect : "staticRoot" in route && route.staticRoot ? `root ${route.staticRoot};
         index index.html;
@@ -1259,6 +1341,7 @@ ${FORWARD_VARS}` : FORWARD_VARS;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $kraft_fwd_proto;
+        proxy_set_header X-Request-ID $request_id;
     }
 ` : "";
     const edgeLua = luaSourceAvailable();
@@ -1277,9 +1360,12 @@ ${renderSlashFallback(route.staticRoot)}` : "";
 ${webhookLocation}${extraLocations}`;
     const httpsUpgradeBody = `${serverHeaders}${proxyOpts}
 ${webhookLocation}${upgradingExtraLocations}`;
+    const hstsHeader = renderHstsHeader(route, { realTls: true });
+    const sharedBodyTls = hstsHeader ? `${sharedBody}
+${hstsHeader}` : sharedBody;
     const httpOnlyBlock = `${GENERATED_HEADER}
 server {
-    listen 80;
+    ${EDGE_LISTEN_80}
     server_name ${route.domain};
 
 ${preamble}
@@ -1300,7 +1386,7 @@ ${serveLocation}
       const keyPath = join(this.certDir, route.domain, "privkey.pem");
       serverBlock = `${GENERATED_HEADER}
 server {
-    listen 80;
+    ${EDGE_LISTEN_80}
     server_name ${route.domain};
 
 ${preamble}
@@ -1315,7 +1401,7 @@ ${redirectOrServeLocation}
 }
 
 server {
-    listen 443 ssl;
+    ${EDGE_LISTEN_443}
     server_name ${route.domain};
 
 ${preamble}
@@ -1324,7 +1410,7 @@ ${luaProxy}
 
     ssl_certificate ${certPath};
     ssl_certificate_key ${keyPath};${proxyTlsOpts}
-${sharedBody}
+${sharedBodyTls}
 ${serveLocation}
 }
 `;
@@ -1336,7 +1422,7 @@ ${serveLocation}
 # certificate because its real certificate has not been issued yet. Kraft
 # replaces this file automatically once it lands. Do not adopt this material.
 server {
-    listen 80;
+    ${EDGE_LISTEN_80}
     server_name ${route.domain};
 
 ${preamble}
@@ -1351,7 +1437,7 @@ ${serveLocation}
 }
 
 server {
-    listen 443 ssl;
+    ${EDGE_LISTEN_443}
     server_name ${route.domain};
 
 ${preamble}
@@ -1367,24 +1453,13 @@ ${serveLocation}
     } else {
       serverBlock = httpOnlyBlock;
     }
-    const snapshot = await this._captureFile(configPath);
-    await this._writeFile(configPath, `${prelude}${serverBlock}`);
-    try {
-      await this.reload();
-    } catch (err) {
-      await this._restoreFile(configPath, snapshot);
-      await this.reload().catch(() => void 0);
-      throw err;
-    }
-    if (!bootstrapServed) {
-      await this._rm(this.bootstrapCertDir(route.domain)).catch(
-        () => void 0
-      );
-    }
-    await this._writeFile(
-      this.routeStatePath(slug),
-      JSON.stringify(route)
-    ).catch(() => void 0);
+    return {
+      route,
+      slug,
+      configPath,
+      conf: `${prelude}${serverBlock}`,
+      bootstrapServed
+    };
   }
   routeStatePath(slug) {
     return join(this.sitesDir, `${slug}.route.json`);
@@ -2259,12 +2334,12 @@ export {
   readMaybeInContainer,
   edgeContainerExecutor,
   validateCertFor,
-  isSafeCertPath,
   readDeclaredPair,
   VHOST_GENERATION,
   readVhostGeneration,
   renderProxyOptions,
   renderProxyTlsOptions,
+  renderHstsHeader,
   renderGeoEntries,
   acmeKeyArgs,
   assertValidChallengeToken,

package/dist/{chunk-IGTODKUA.js → chunk-5RWL7EFH.js}

@@ -19,16 +19,16 @@ import {
   rollbackEdgeTakeover,
   scanImportableSites,
   unreachableStaticRoots
-} from "./chunk-MOSINQAM.js";
+} from "./chunk-AFUXAAFQ.js";
 import {
   ourEdgeContainerRunning
-} from "./chunk-PCOTSRS4.js";
+} from "./chunk-QLPQ5NFE.js";
 import {
   LocalExecutor
-} from "./chunk-HFOE2IXZ.js";
+} from "./chunk-BIOW6K3V.js";
 import {
   isOurEdgeContainer
-} from "./chunk-3RCXJZJD.js";
+} from "./chunk-E3J47WO3.js";
 
 // src/lib/edge-preflight.ts
 import { spawnSync } from "child_process";
@@ -263,7 +263,7 @@ async function repairEdgeConflict(mode, apiPort, onLog) {
   }
   spawnSync("docker", ["restart", "kraft-edge"], { stdio: "ignore" });
   if (mode === "migrate" && scan.sites.length > 0) {
-    const { importMigratedSites } = await import("./edge-import-RZD7MMOE.js");
+    const { importMigratedSites } = await import("./edge-import-WRU5JQ43.js");
     const outcome = await importMigratedSites(apiPort, scan.sites, certPems);
     if (outcome.registered.length === 0) {
       return {

package/dist/{chunk-ZQJU5CTZ.js → chunk-7VMXN646.js}

@@ -10,7 +10,7 @@ import {
   firewallRevokeSteps,
   refused,
   shellQuote
-} from "./chunk-ND23EK7Y.js";
+} from "./chunk-G4VGNFGV.js";
 
 // ../../packages/adapters/src/system/environment-ops.ts
 function opScript(steps) {

package/dist/{chunk-DJNKEVZ7.js → chunk-AADWLI2S.js}

@@ -12,7 +12,7 @@ import {
   HOST_CHANNEL_ROW_CREDENTIALS_UNUSED,
   hostFirewallRule,
   safeErrorMessage
-} from "./chunk-ND23EK7Y.js";
+} from "./chunk-G4VGNFGV.js";
 
 // ../../packages/adapters/src/system/ssh-client.ts
 import { Client } from "ssh2";